The Jane Goodall Institute

The Jane Goodall Institute notified the NH AG of a ransomware attack on vendor Blackbaud in May 2020. JGI learned of the incident on July 22, 2020. The attack compromised personally identifying information of approximately 724 donors/prospective donors (including NH residents). No credit card, bank account, or SSN data was impacted. JGI notified affected individuals on July 31, 2020.

The Jane Goodall Institute notified South Carolina of a third-party vendor breach involving Blackbaud. A ransomware attack on Blackbaud resulted in the exfiltration of donor PII (names, contact info). No financial or SSN data was compromised. The Institute is conducting an independent inquiry.

The Jane Goodall Institute reported a data breach to the Oregon Attorney General. The breach was reported on 2020-08-28. The breach was discovered on 7/22/2020. 110,642 individuals were affected. Notice was sent on 7/31/2020.

The Jane Goodall Institute notified donors of a data security incident at its vendor, Blackbaud, which was the target of a ransomware attack. Hackers obtained personally identifying information about donors and prospective donors. No credit card, bank account, or social security numbers were compromised. Blackbaud believes it retrieved the stolen data. JGI is conducting an independent inquiry and exploring alternative providers.

The Jane Goodall Institute reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2020-08-28. 2,500 Massachusetts residents were affected. The report records the breach type as electronic.

The Jane Goodall Institute reported a data breach to the Indiana Attorney General. The breach occurred on 2020-05-01 and was reported on 2020-07-31. 1,035 Indiana residents were affected. 110,642 individuals affected in total.

JANE GOODALL INSTITUTE filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-313). The register records the breach as discovered on July 22, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.